[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Pkg-puppet-devel] Wheezy update of puppet?



On Wed, May 24, 2017 at 5:51 PM, Apollon Oikonomopoulos wrote:

> So, from my understanding the version in Wheezy cannot be fixed: the 2.7
> agents only use YAML to send out facts and upstream's fix is to simply
> not accept anything other than PSON. Whitelisting YAML defeats the
> purpose, as it's YAML's deserialization of untrusted data that leads to
> remote code execution.

In Python/Perl YAML libraries there are ways to safely load YAML
files, does Ruby not have the same possibilities?

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


Reply to: